datadog-opentelemetry has unbounded W3C tracestate parsing that may lead to DoS
Datadog tracing libraries that implement W3C Trace Context (tracecontext) propagation parse the incoming tracestate header without enforcing a size cap on the Datadog vendor entry (dd=…). The dd= value contains semicolon-separated key:value pairs, and the parser allocates a hash-map entry for each pair. A remote, unauthenticated attacker can send a tracestate header whose dd= member is arbitrarily large (or contains an arbitrarily large number of pairs), forcing unbounded CPU and …